ci: stop the Dependabot docker job that has failed every week for two months

[0xmanhnv]

The bug

docker in /. - Update has failed on eight consecutive Mondays on main —
2026-06-07, 06-14, 06-21, 06-28, 07-05, 07-12, 07-19, 07-26 — and has never once
opened a pull request.

From the run log:

GET https://public.ecr.aws/v2/docker/library/golang/tags/list
401 {"errors":[{"code":"DENIED","message":"Not Authorized"}]}

The Dockerfiles pin base images on ECR Public to dodge Docker Hub pull rate limits
in CI, and Dependabot's docker updater cannot authenticate against ECR Public to
list tags. The job could never do its job.

That makes it worse than no check at all: a permanently red run on the default
branch teaches everyone to ignore a failing check.

Why agent and not api/ui

api and ui hit the identical failure and removed the ecosystem two months ago
(api#213, ui#194). agent was missed — so it kept failing every week
while the other two went quiet. This closes the gap.

Found by taking the latest run of every workflow on each repo's shipping branch;
agent's docker job was the only thing still red anywhere across api / ui / agent /
sdk-go / ctis.

This does not lose CVE coverage

Nothing is lost by removing this, because the Dependabot docker job never
produced anything — but it is worth being precise about what does cover base
images, and where the edges are.

The Docker Image Scan job in .github/workflows/security.yml builds the image
and runs Trivy over it at CRITICAL,HIGH. It genuinely runs: the last Security
run on main reports success for it, alongside Trivy FS, CodeQL, License
Compliance and Go Vulnerability Check. (It shows as skipping on this PR — see
the gate below.)

Two edges I would rather state than gloss over:

1. It is gated to pushes on main
   (if: github.event_name == 'push' && github.ref == 'refs/heads/main'), so it
   does not run on pull requests or on the weekly schedule. A CVE newly
   disclosed in a base image is therefore not surfaced by the image scan until the
   next push to main. The weekly scheduled run still covers Trivy FS, CodeQL and
   Go Vulnerability Check — just not the built image.
2. It builds the default Dockerfile only, so the four variant images
   (nuclei / gitleaks / semgrep / trivy) get the filesystem scan plus manual
   bumps, not an image scan.

Neither is a regression from this PR — both are true today. Dropping the
schedule gate on docker-scan and adding the variants would close them, and is
a separate change.

Verification

• .github/dependabot.yml parses as valid YAML; remaining ecosystems are
  gomod and github-actions, both unchanged and both currently green.
• Checked all five Dockerfiles: every external base image is on public.ecr.aws
  except the distroless runtime stage in Dockerfile, which is on gcr.io. The
  comment says so rather than overstating it.